×

Instance based learning framework for effective behavior profiling and anomaly intrusion detection

  • US 7,814,548 B2
  • Filed: 09/13/2005
  • Issued: 10/12/2010
  • Est. Priority Date: 09/13/2005
  • Status: Active Grant
First Claim
Patent Images

1. A computer implemented instance-based learning method for detecting intruders into a computer comprising:

  • capturing historical data input into the computer by a user during a training mode;

    profiling the historical data during the training mode by converting streams of shell command traces into fixed length instances;

    profiling the fixed length instances to identify normal behavior using a single data structure and a clustering algorithm with respect to the data structure, the data structure comprising a list of tables, the tables among said list of tables having a size that is limited by an upper bound;

    determining a representative instance;

    comparing the representative instance to the fixed length instances utilizing the clustering algorithm in order to create clusters that are mapped to the tables among said list of tables;

    capturing test data input by the user into the computer during an operational mode;

    comparing the test data with the profiled historical data in accordance with a predetermined similarity metric during the operational mode to identify test data that falls outside of previously identified clusters,selecting dynamically a set of representative instances, wherein each of the representative instances represents a corresponding one of the clusters,calculating similarity scores between query instances and each of the representative instances,using the similarity metric, producing a real, non-negative root for each similarity score within a predefined interval,using each root, determining the representation in the list of tables of each respective query instancedisplaying a notification upon identifying the test data falling outside previously identified clusters.

View all claims
  • 1 Assignment
Timeline View
Assignment View
    ×
    ×